AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch only modifies KVM selftests for RISC-V (tools/testing/selftests/kvm/*) to add vector instruction decoding and lazy V extension enablement in the guest exception handler. It does not modify any core kernel logic, drivers, or architectures.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 485013e0b0e81a9b9f35c88427bc9262f63c55a4\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Thu Aug 13 12:36:46 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/tools/testing/selftests/kvm/include/riscv/processor.h b/tools/testing/selftests/kvm/include/riscv/processor.h\nindex e3acf2ae9881e..685baefebdb12 100644\n--- a/tools/testing/selftests/kvm/include/riscv/processor.h\n+++ b/tools/testing/selftests/kvm/include/riscv/processor.h\n@@ -25,6 +25,19 @@\n #define GET_RM(insn)            (((insn) \u0026 INSN_MASK_FUNCT3) \u003e\u003e INSN_SHIFT_FUNCT3)\n #define GET_CSR_NUM(insn)       (((insn) \u0026 INSN_CSR_MASK) \u003e\u003e INSN_CSR_SHIFT)\n \n+/* Vector (V) instruction decoding, matching arch/riscv/include/asm/insn.h */\n+#define RV_INSN_OPCODE_MASK\t0x7f\n+#define RVG_OPCODE_SYSTEM\t0x73\n+#define RVV_OPCODE_VECTOR\t0x57\n+#define RVV_OPCODE_VL\t\t0x07\n+#define RVV_OPCODE_VS\t\t0x27\n+#define RVV_VL_VS_WIDTH_8\t0\n+#define RVV_VL_VS_WIDTH_16\t5\n+#define RVV_VL_VS_WIDTH_32\t6\n+#define RVV_VL_VS_WIDTH_64\t7\n+#define RVV_EXTRACT_VL_VS_WIDTH(insn)\t(((insn) \u003e\u003e 12) \u0026 0x7)\n+#define RVG_EXTRACT_SYSTEM_CSR(insn)\t(((insn) \u003e\u003e 20) \u0026 0xfff)\n+\n static inline u64 __kvm_reg_id(u64 type, u64 subtype, u64 idx, u64 size)\n {\n \treturn KVM_REG_RISCV | type | subtype | idx | size;\ndiff --git a/tools/testing/selftests/kvm/lib/riscv/processor.c b/tools/testing/selftests/kvm/lib/riscv/processor.c\nindex ded5429f34483..d00ac997291c0 100644\n--- a/tools/testing/selftests/kvm/lib/riscv/processor.c\n+++ b/tools/testing/selftests/kvm/lib/riscv/processor.c\n@@ -17,6 +17,11 @@\n \n static gva_t exception_handlers;\n \n+struct handlers {\n+\texception_handler_fn exception_handlers[NR_VECTORS][NR_EXCEPTIONS];\n+\tbool v_available;\n+};\n+\n bool __vcpu_has_ext(struct kvm_vcpu *vcpu, u64 ext)\n {\n \tunsigned long value = 0;\n@@ -298,13 +303,6 @@ void vcpu_arch_dump(FILE *stream, struct kvm_vcpu *vcpu, u8 indent)\n \t\tcore.regs.t3, core.regs.t4, core.regs.t5, core.regs.t6);\n }\n \n-static void __aligned(16) guest_unexp_trap(void)\n-{\n-\tsbi_ecall(KVM_RISCV_SELFTESTS_SBI_EXT,\n-\t\t  KVM_RISCV_SELFTESTS_SBI_UNEXP,\n-\t\t  0, 0, 0, 0, 0, 0);\n-}\n-\n void vcpu_arch_set_entry_point(struct kvm_vcpu *vcpu, void *guest_code)\n {\n \tvcpu_set_reg(vcpu, RISCV_CORE_REG(regs.pc), (unsigned long)guest_code);\n@@ -348,8 +346,26 @@ struct kvm_vcpu *vm_arch_vcpu_add(struct kvm_vm *vm, u32 vcpu_id)\n \t/* Setup sscratch for guest_get_vcpuid() */\n \tvcpu_set_reg(vcpu, RISCV_GENERAL_CSR_REG(sscratch), vcpu_id);\n \n-\t/* Setup default exception vector of guest */\n-\tvcpu_set_reg(vcpu, RISCV_GENERAL_CSR_REG(stvec), (unsigned long)guest_unexp_trap);\n+\t/*\n+\t * Advertise V to KVM so -O2 auto-vectorization in guest code is valid;\n+\t * ignore errors since the tests work without V too. Use the full\n+\t * exception vector table (which lazily enables V in route_exception())\n+\t * as the default handler; vm_init_vector_tables() is idempotent.\n+\t */\n+\t__vcpu_set_reg(vcpu, RISCV_ISA_EXT_REG(KVM_RISCV_ISA_EXT_V), 1);\n+\tvm_init_vector_tables(vm);\n+\tvcpu_init_vector_tables(vcpu);\n+\n+\t/*\n+\t * Record V availability for route_exception(), which runs in guest\n+\t * context. V is enabled uniformly for every vCPU, so this is a\n+\t * VM-wide property.\n+\t */\n+\t{\n+\t\tstruct handlers *h = addr_gva2hva(vm, vm-\u003ehandlers);\n+\n+\t\th-\u003ev_available = __vcpu_has_isa_ext(vcpu, KVM_RISCV_ISA_EXT_V);\n+\t}\n \n \treturn vcpu;\n }\n@@ -408,19 +424,43 @@ void assert_on_unhandled_exception(struct kvm_vcpu *vcpu)\n \tstruct ucall uc;\n \n \tif (get_ucall(vcpu, \u0026uc) == UCALL_UNHANDLED) {\n+\t\tvcpu_dump(stderr, vcpu, 2);\n \t\tTEST_FAIL(\"Unexpected exception (vector:0x%lx, ec:0x%lx)\",\n \t\t\tuc.args[0], uc.args[1]);\n \t}\n }\n \n-struct handlers {\n-\texception_handler_fn exception_handlers[NR_VECTORS][NR_EXCEPTIONS];\n-};\n+static bool insn_is_vector(u32 insn)\n+{\n+\tu32 opcode = insn \u0026 RV_INSN_OPCODE_MASK;\n+\tu32 width, csr;\n+\n+\t/* All V-related instructions are 4-byte, i.e. not compressed. */\n+\tif ((insn \u0026 0x3) != 0x3)\n+\t\treturn false;\n+\n+\tswitch (opcode) {\n+\tcase RVV_OPCODE_VECTOR:\n+\t\treturn true;\n+\tcase RVV_OPCODE_VL:\n+\tcase RVV_OPCODE_VS:\n+\t\twidth = RVV_EXTRACT_VL_VS_WIDTH(insn);\n+\t\treturn width == RVV_VL_VS_WIDTH_8 || width == RVV_VL_VS_WIDTH_16 ||\n+\t\t       width == RVV_VL_VS_WIDTH_32 || width == RVV_VL_VS_WIDTH_64;\n+\tcase RVG_OPCODE_SYSTEM:\n+\t\tcsr = RVG_EXTRACT_SYSTEM_CSR(insn);\n+\t\treturn (csr \u003e= CSR_VSTART \u0026\u0026 csr \u003c= CSR_VCSR) ||\n+\t\t       (csr \u003e= CSR_VL \u0026\u0026 csr \u003c= CSR_VLENB);\n+\t}\n+\n+\treturn false;\n+}\n \n void route_exception(struct pt_regs *regs)\n {\n \tstruct handlers *handlers = (struct handlers *)exception_handlers;\n-\tint vector = 0, ec;\n+\tint vector = 0;\n+\tunsigned long ec;\n \n \tec = regs-\u003ecause \u0026 ~CAUSE_IRQ_FLAG;\n \tif (ec \u003e= NR_EXCEPTIONS)\n@@ -432,6 +472,36 @@ void route_exception(struct pt_regs *regs)\n \t\tec = 0;\n \t}\n \n+\t/*\n+\t * Lazily enable V on the first vector instruction: if the faulting\n+\t * instruction decodes as vector while VS is off, set VS to Initial\n+\t * and re-execute it, like the kernel's riscv_v_first_use_handler().\n+\t * Genuinely illegal instructions continue to the unexpected-exception\n+\t * path.\n+\t */\n+\tif (!(regs-\u003ecause \u0026 CAUSE_IRQ_FLAG) \u0026\u0026 ec == EXC_INST_ILLEGAL \u0026\u0026\n+\t    handlers \u0026\u0026 handlers-\u003ev_available \u0026\u0026 !(regs-\u003estatus \u0026 SR_VS)) {\n+\t\tu32 insn = (u32)regs-\u003ebadaddr;\n+\n+\t\t/*\n+\t\t * stval is not guaranteed to hold the faulting instruction.\n+\t\t * Vector instructions are always 32-bit, so check the first\n+\t\t * 16-bit halfword and, for a 32-bit instruction, assemble it\n+\t\t * from two halfwords to avoid an unaligned 32-bit access.\n+\t\t */\n+\t\tif (!insn) {\n+\t\t\tu16 half = *(u16 *)regs-\u003eepc;\n+\n+\t\t\tif ((half \u0026 0x3) == 0x3)\n+\t\t\t\tinsn = (u32)half | ((u32)*(u16 *)(regs-\u003eepc + 2) \u003c\u003c 16);\n+\t\t}\n+\n+\t\tif (insn_is_vector(insn)) {\n+\t\t\tregs-\u003estatus |= SR_VS_INITIAL;\n+\t\t\treturn;\n+\t\t}\n+\t}\n+\n \tif (handlers \u0026\u0026 handlers-\u003eexception_handlers[vector][ec])\n \t\treturn handlers-\u003eexception_handlers[vector][ec](regs);\n \n@@ -448,6 +518,9 @@ void vcpu_init_vector_tables(struct kvm_vcpu *vcpu)\n \n void vm_init_vector_tables(struct kvm_vm *vm)\n {\n+\tif (vm-\u003ehandlers)\n+\t\treturn;\n+\n \tvm-\u003ehandlers = __vm_alloc(vm, sizeof(struct handlers), vm-\u003epage_size,\n \t\t\t\t  MEM_REGION_DATA);\n \n"
}

best-expensive

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies KVM selftests for RISC-V (tools/testing/selftests/kvm/*) to add vector instruction decoding and lazy V extension enablement in the guest exception handler. It does not modify any core kernel logic, drivers, or architectures.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 485013e0b0e81a9b9f35c88427bc9262f63c55a4
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Aug 13 12:36:46 2026 +0000

    syz-cluster: applied patch under review

diff --git a/tools/testing/selftests/kvm/include/riscv/processor.h b/tools/testing/selftests/kvm/include/riscv/processor.h
index e3acf2ae9881e..685baefebdb12 100644
--- a/tools/testing/selftests/kvm/include/riscv/processor.h
+++ b/tools/testing/selftests/kvm/include/riscv/processor.h
@@ -25,6 +25,19 @@
 #define GET_RM(insn)            (((insn) & INSN_MASK_FUNCT3) >> INSN_SHIFT_FUNCT3)
 #define GET_CSR_NUM(insn)       (((insn) & INSN_CSR_MASK) >> INSN_CSR_SHIFT)
 
+/* Vector (V) instruction decoding, matching arch/riscv/include/asm/insn.h */
+#define RV_INSN_OPCODE_MASK	0x7f
+#define RVG_OPCODE_SYSTEM	0x73
+#define RVV_OPCODE_VECTOR	0x57
+#define RVV_OPCODE_VL		0x07
+#define RVV_OPCODE_VS		0x27
+#define RVV_VL_VS_WIDTH_8	0
+#define RVV_VL_VS_WIDTH_16	5
+#define RVV_VL_VS_WIDTH_32	6
+#define RVV_VL_VS_WIDTH_64	7
+#define RVV_EXTRACT_VL_VS_WIDTH(insn)	(((insn) >> 12) & 0x7)
+#define RVG_EXTRACT_SYSTEM_CSR(insn)	(((insn) >> 20) & 0xfff)
+
 static inline u64 __kvm_reg_id(u64 type, u64 subtype, u64 idx, u64 size)
 {
 	return KVM_REG_RISCV | type | subtype | idx | size;
diff --git a/tools/testing/selftests/kvm/lib/riscv/processor.c b/tools/testing/selftests/kvm/lib/riscv/processor.c
index ded5429f34483..d00ac997291c0 100644
--- a/tools/testing/selftests/kvm/lib/riscv/processor.c
+++ b/tools/testing/selftests/kvm/lib/riscv/processor.c
@@ -17,6 +17,11 @@
 
 static gva_t exception_handlers;
 
+struct handlers {
+	exception_handler_fn exception_handlers[NR_VECTORS][NR_EXCEPTIONS];
+	bool v_available;
+};
+
 bool __vcpu_has_ext(struct kvm_vcpu *vcpu, u64 ext)
 {
 	unsigned long value = 0;
@@ -298,13 +303,6 @@ void vcpu_arch_dump(FILE *stream, struct kvm_vcpu *vcpu, u8 indent)
 		core.regs.t3, core.regs.t4, core.regs.t5, core.regs.t6);
 }
 
-static void __aligned(16) guest_unexp_trap(void)
-{
-	sbi_ecall(KVM_RISCV_SELFTESTS_SBI_EXT,
-		  KVM_RISCV_SELFTESTS_SBI_UNEXP,
-		  0, 0, 0, 0, 0, 0);
-}
-
 void vcpu_arch_set_entry_point(struct kvm_vcpu *vcpu, void *guest_code)
 {
 	vcpu_set_reg(vcpu, RISCV_CORE_REG(regs.pc), (unsigned long)guest_code);
@@ -348,8 +346,26 @@ struct kvm_vcpu *vm_arch_vcpu_add(struct kvm_vm *vm, u32 vcpu_id)
 	/* Setup sscratch for guest_get_vcpuid() */
 	vcpu_set_reg(vcpu, RISCV_GENERAL_CSR_REG(sscratch), vcpu_id);
 
-	/* Setup default exception vector of guest */
-	vcpu_set_reg(vcpu, RISCV_GENERAL_CSR_REG(stvec), (unsigned long)guest_unexp_trap);
+	/*
+	 * Advertise V to KVM so -O2 auto-vectorization in guest code is valid;
+	 * ignore errors since the tests work without V too. Use the full
+	 * exception vector table (which lazily enables V in route_exception())
+	 * as the default handler; vm_init_vector_tables() is idempotent.
+	 */
+	__vcpu_set_reg(vcpu, RISCV_ISA_EXT_REG(KVM_RISCV_ISA_EXT_V), 1);
+	vm_init_vector_tables(vm);
+	vcpu_init_vector_tables(vcpu);
+
+	/*
+	 * Record V availability for route_exception(), which runs in guest
+	 * context. V is enabled uniformly for every vCPU, so this is a
+	 * VM-wide property.
+	 */
+	{
+		struct handlers *h = addr_gva2hva(vm, vm->handlers);
+
+		h->v_available = __vcpu_has_isa_ext(vcpu, KVM_RISCV_ISA_EXT_V);
+	}
 
 	return vcpu;
 }
@@ -408,19 +424,43 @@ void assert_on_unhandled_exception(struct kvm_vcpu *vcpu)
 	struct ucall uc;
 
 	if (get_ucall(vcpu, &uc) == UCALL_UNHANDLED) {
+		vcpu_dump(stderr, vcpu, 2);
 		TEST_FAIL("Unexpected exception (vector:0x%lx, ec:0x%lx)",
 			uc.args[0], uc.args[1]);
 	}
 }
 
-struct handlers {
-	exception_handler_fn exception_handlers[NR_VECTORS][NR_EXCEPTIONS];
-};
+static bool insn_is_vector(u32 insn)
+{
+	u32 opcode = insn & RV_INSN_OPCODE_MASK;
+	u32 width, csr;
+
+	/* All V-related instructions are 4-byte, i.e. not compressed. */
+	if ((insn & 0x3) != 0x3)
+		return false;
+
+	switch (opcode) {
+	case RVV_OPCODE_VECTOR:
+		return true;
+	case RVV_OPCODE_VL:
+	case RVV_OPCODE_VS:
+		width = RVV_EXTRACT_VL_VS_WIDTH(insn);
+		return width == RVV_VL_VS_WIDTH_8 || width == RVV_VL_VS_WIDTH_16 ||
+		       width == RVV_VL_VS_WIDTH_32 || width == RVV_VL_VS_WIDTH_64;
+	case RVG_OPCODE_SYSTEM:
+		csr = RVG_EXTRACT_SYSTEM_CSR(insn);
+		return (csr >= CSR_VSTART && csr <= CSR_VCSR) ||
+		       (csr >= CSR_VL && csr <= CSR_VLENB);
+	}
+
+	return false;
+}
 
 void route_exception(struct pt_regs *regs)
 {
 	struct handlers *handlers = (struct handlers *)exception_handlers;
-	int vector = 0, ec;
+	int vector = 0;
+	unsigned long ec;
 
 	ec = regs->cause & ~CAUSE_IRQ_FLAG;
 	if (ec >= NR_EXCEPTIONS)
@@ -432,6 +472,36 @@ void route_exception(struct pt_regs *regs)
 		ec = 0;
 	}
 
+	/*
+	 * Lazily enable V on the first vector instruction: if the faulting
+	 * instruction decodes as vector while VS is off, set VS to Initial
+	 * and re-execute it, like the kernel's riscv_v_first_use_handler().
+	 * Genuinely illegal instructions continue to the unexpected-exception
+	 * path.
+	 */
+	if (!(regs->cause & CAUSE_IRQ_FLAG) && ec == EXC_INST_ILLEGAL &&
+	    handlers && handlers->v_available && !(regs->status & SR_VS)) {
+		u32 insn = (u32)regs->badaddr;
+
+		/*
+		 * stval is not guaranteed to hold the faulting instruction.
+		 * Vector instructions are always 32-bit, so check the first
+		 * 16-bit halfword and, for a 32-bit instruction, assemble it
+		 * from two halfwords to avoid an unaligned 32-bit access.
+		 */
+		if (!insn) {
+			u16 half = *(u16 *)regs->epc;
+
+			if ((half & 0x3) == 0x3)
+				insn = (u32)half | ((u32)*(u16 *)(regs->epc + 2) << 16);
+		}
+
+		if (insn_is_vector(insn)) {
+			regs->status |= SR_VS_INITIAL;
+			return;
+		}
+	}
+
 	if (handlers && handlers->exception_handlers[vector][ec])
 		return handlers->exception_handlers[vector][ec](regs);
 
@@ -448,6 +518,9 @@ void vcpu_init_vector_tables(struct kvm_vcpu *vcpu)
 
 void vm_init_vector_tables(struct kvm_vm *vm)
 {
+	if (vm->handlers)
+		return;
+
 	vm->handlers = __vm_alloc(vm, sizeof(struct handlers), vm->page_size,
 				  MEM_REGION_DATA);
 

gemini-3.1-pro-preview

null

null

							input: 4304
							output: 88
							thoughts: 416
						

**KVM Selftest Patch Analysis**

Okay, so I've got this patch affecting `tools/testing/selftests/kvm/include/riscv/processor.h` and `tools/testing/selftests/kvm/lib/riscv/processor.c`. It's tweaking the KVM selftests for RISC-V, specifically adding vector instruction decoding and lazy enabling of the V extension within the guest exception handler. My initial thought is, "Self-tests only, right?" But I need to be *absolutely* sure.

Let's quickly verify. Right, it's explicitly in the `tools/testing/selftests/kvm/*` subtree. Okay, *that* confirms it. No modifications to the core kernel itself. No drivers, no architecture-specific code beyond the testing framework. Nothing that directly impacts the kernel's functional behavior. I'm going to quickly diff the files to double-check. Yup, just those two files. All good.

So, given that this patch *only* touches selftests, adding vector instruction decoding and lazily enabling the V extension in the guest exception handler, and has absolutely zero impact on core kernel logic, drivers, or any other critical kernel components, there's no need to fuzz this. This is a purely testing-focused change. I'm going to set `WorthFuzzing=false`. Then let's call `set-results`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies KVM selftests for RISC-V (tools/testing/selftests/kvm/*) to add vector instruction decoding and lazy V extension enablement in the guest exception handler. It does not modify any core kernel logic, drivers, or architectures.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies KVM selftests for RISC-V (tools/testing/selftests/kvm/*) to add vector instruction decoding and lazy V extension enablement in the guest exception handler. It does not modify any core kernel logic, drivers, or architectures.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null